Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-30 01:48:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: ( bookings ) restrict reservation issuance to admins

Browse Source
This commit is contained in:
Abubeker Yasin
2026-07-28 09:31:01 +03:00
parent f6084d8c80
commit 236d55580a
3 changed files with 31 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts
View File

@@ -352,12 +352,12 @@ export class BookingsController {
}
@Post("reservations/:seatId/issue")
@PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.bookings.manage, PASSENGER_PERMS.admin])
@PassengerAdmin()
@ApiBearerAuth("IAM-auth")
@ApiOperation({
summary: "Issue a booking from a reserved (blocked) seat",
summary: "Issue a booking from a reserved (blocked) seat — admin only",
description:
"Converts an admin-reserved seat into a real booking for one traveler. bookingKind STAFF waives the fee and issues the ticket immediately; bookingKind PASSENGER creates the booking as PENDING_PAYMENT and texts a payment link to the traveler's phone.",
"Converts an admin-reserved seat into a real booking for one traveler. bookingKind STAFF waives the fee and issues the ticket immediately; bookingKind PASSENGER creates the booking as PENDING_PAYMENT and texts a payment link to the traveler's phone. Restricted to admins (edr_passenger_app:admin) because STAFF issuance waives the fare.",
})
@ApiBody({ type: IssueReservationBookingDto })
issueBookingFromReservation(